so tokens act on their own behalf but also on behalf of their underlying users?